SCS-C02 Practice Test 28 — 15 Questions

Question 1

A security engineer is troubleshooting why Amazon GuardDuty is not generating findings for suspicious S3 API calls made by an IAM role. The engineer has verified that GuardDuty is enabled in the account and region. What is a likely reason for the missing findings?

Accepted Answer

CloudTrail management events are not being logged for the IAM role.. Option C is correct because GuardDuty requires CloudTrail management events to be logged; if the trail is not logging management events for the role's API calls, GuardDuty cannot analyze them. Option A is wrong because GuardDuty can analyze S3 data events if enabled. Option B is wrong because Delegated Admin is for multi-account management, not single account. Option D is wrong because VPC Flow Logs are not used for S3 API calls.

Answer

VPC Flow Logs are not enabled for the VPC where the role is used.

Answer

The account is not a Delegated Admin for GuardDuty.

Answer

S3 data events are not enabled in CloudTrail.

Question 2

A security engineer needs to ensure that all S3 object-level API calls (e.g., GetObject, PutObject) on the bucket 'my-bucket' are logged. The current CloudTrail configuration is as shown in the exhibit. What change should the engineer make?

Accepted Answer

Change the data resource value to 'arn:aws:s3:::my-bucket/' to cover all objects.. Option B is correct because the current data resource only specifies the prefix 'logs/', not the entire bucket. To log all object-level events for the bucket, the value should be 'arn:aws:s3:::my-bucket/'. Option A is wrong because the bucket itself is not the issue; the prefix is. Option C is wrong because the trail already includes management events. Option D is wrong because the trail already has a data resource for S3.

Answer

Remove the DataResources section and add an AdvancedEventSelector for S3.

Answer

Change the bucket ARN to 'arn:aws:s3:::my-bucket' without a trailing slash.

Answer

Enable management events by setting IncludeManagementEvents to true.

Question 3

Refer to the exhibit. A security engineer is analyzing a VPC Flow Log entry from an EC2 instance with private IP 10.0.1.5. The log shows an outbound connection to IP 203.0.113.5 on port 443 from source port 22. The connection was accepted. What is the most likely scenario?

Accepted Answer

The instance is responding to an inbound SSH connection from the remote IP.. Option C is correct. VPC Flow Logs record connections from the perspective of the network interface. The source IP and port are the instance's private IP and ephemeral port. Here, the source port is 22 (SSH), which is unusual for an outbound connection. This suggests the entry might be a reply to an inbound SSH connection (since flow logs capture both directions). The instance is likely replying to an SSH session initiated from the remote IP. Option A is wrong because port 22 is SSH, not HTTPS. Option B is wrong because the instance is the source in the log, not the destination. Option D is wrong because the remote IP is not private.

Answer

The instance is connecting to a remote server on the internal network.

Answer

The instance is receiving an SSH connection from the remote IP.

Answer

The instance is making an HTTPS request to a web server.

Question 4

A security engineer is configuring a centralized logging solution for multiple AWS accounts. The engineer needs to ensure that log files are encrypted at rest and that access to the logs is audited. Which combination of services and features should be used?

Accepted Answer

Use S3 SSE-KMS and enable CloudTrail for S3 data events.. S3 SSE-KMS provides encryption at rest with key management, and CloudTrail logs all access to the S3 bucket. Option C is correct. Option A is wrong because SSE-S3 does not provide key management or access audit. Option B is wrong because SSE-C requires customer-managed keys but does not provide audit. Option D is wrong because KMS alone without CloudTrail does not audit access.

Answer

Use S3 SSE-S3 and enable S3 access logs.

Answer

Use AWS KMS to encrypt the logs before uploading to S3.

Answer

Use S3 SSE-C and enable CloudTrail for S3 data events.

Question 5

A company wants to centralize logging from multiple AWS accounts into a single logging account. The logs include AWS CloudTrail, AWS Config, and VPC Flow Logs. Which solution should the company implement to meet these requirements with minimal operational overhead?

Accepted Answer

Use AWS Organizations to create a CloudTrail trail that applies to all accounts and delivers logs to a central S3 bucket.. Option A is correct because AWS Organizations allows centralized management of accounts and can be used with CloudTrail to create a trail that logs all accounts. Option B is wrong because S3 cross-region replication replicates objects, not logs from multiple accounts automatically. Option C is wrong because Kinesis Data Firehose would require additional setup per account. Option D is wrong because Lambda would require custom code and per-account setup.

Answer

Use Amazon Kinesis Data Firehose in each account to send logs to a central Amazon S3 bucket.

Answer

Configure each account to deliver logs to its own S3 bucket and use S3 cross-region replication to copy logs to the central bucket.

Answer

Use AWS Lambda functions in each account to copy log files to a central S3 bucket.

Question 6

A company is experiencing unauthorized access attempts to an S3 bucket. Which AWS service can be used to detect and alert on such events in real time?

Accepted Answer

Amazon GuardDuty. Option B is correct because Amazon GuardDuty uses threat intelligence to detect suspicious activity, including unauthorized S3 access attempts. Option A is wrong because AWS CloudTrail is for logging, not real-time detection. Option C is wrong because Amazon Macie is for data classification. Option D is wrong because AWS Config is for compliance.

Answer

Amazon Macie

Answer

AWS Config

Answer

AWS CloudTrail

Question 7

Which TWO AWS services can be used to detect and alert on suspicious activity in near real-time?

Accepted Answer

Amazon CloudWatch Events. Options A and D are correct. Amazon GuardDuty provides near real-time threat detection, and Amazon CloudWatch Events can trigger alerts based on patterns. Option B (Config) is for compliance, not threat detection. Option C (CloudTrail) is for logging, not real-time alerting. Option E (Inspector) is for vulnerability scanning.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

AWS Config

Question 8

A company has enabled AWS CloudTrail in all regions and is delivering logs to an S3 bucket. The security team wants to ensure that any attempt to disable CloudTrail logging is detected and alerted. Which approach should be used?

Accepted Answer

Create a CloudWatch Events rule that matches the StopLogging API call and sends a notification via SNS.. Option B is correct because a CloudWatch Events (EventBridge) rule can match the StopLogging or UpdateTrail API calls from CloudTrail and trigger an SNS notification. Option A is wrong because AWS Config can evaluate whether CloudTrail is enabled, but may not detect a disablement in real-time; it is more for compliance. Option C is wrong because VPC Flow Logs do not capture API calls. Option D is wrong because Amazon GuardDuty does not monitor CloudTrail configuration changes.

Answer

Enable Amazon GuardDuty to detect CloudTrail disablement.

Answer

Use AWS Config to create a rule that checks if CloudTrail is enabled.

Answer

Enable VPC Flow Logs to capture traffic to the CloudTrail endpoint.

Question 9

A company uses AWS Organizations and wants to enable Amazon GuardDuty across all member accounts. The security team wants to centrally manage findings and automate responses. What is the MOST efficient way to achieve this?

Accepted Answer

Designate a Delegated Administrator account for GuardDuty in AWS Organizations and enable GuardDuty for all accounts from that account.. Option B is correct because GuardDuty supports multi-account management via a Delegated Administrator, which can enable GuardDuty in all accounts and aggregate findings. Option A is wrong because it requires manual steps. Option C is wrong because Security Hub aggregates findings but does not enable GuardDuty. Option D is wrong because CloudFormation StackSets can deploy but are less efficient for enabling a service across many accounts.

Answer

Use AWS CloudFormation StackSets to deploy a GuardDuty detector in each account.

Answer

Enable AWS Security Hub in the management account and configure it to ingest GuardDuty findings from member accounts.

Answer

Enable GuardDuty in each member account individually and configure cross-account access to a central S3 bucket.

Question 10

A security engineer is configuring a multi-account CloudTrail setup. The above bucket policy is attached to the central logging bucket. Despite the policy, CloudTrail in the member account (123456789012) cannot deliver logs. What is the MOST likely issue?

Accepted Answer

The condition s3:x-amz-acl is not required; CloudTrail does not set that ACL.. Option B is correct because the resource path includes the account ID, but the condition requires the ACL to be set to bucket-owner-full-control, which CloudTrail does not set by default. Option A is wrong because the principal is correct. Option C is wrong because the bucket policy does not need to specify the source account explicitly; the path includes it. Option D is wrong because the action is correct.

Answer

The Principal should be the CloudTrail service principal of the member account.

Answer

The Action should be s3:PutObjectAcl instead of s3:PutObject.

Answer

The resource ARN must include the source account ID in the path.

Question 11

Refer to the exhibit. A security engineer is reviewing a CloudTrail event. What security concern does this event raise?

Accepted Answer

The user is opening SSH access to the world.. Option B is correct. The event shows an IAM user adding an inbound rule to security group sg-12345 that allows SSH (port 22) from any IP (0.0.0.0/0). This is a security best practice violation because it exposes the instance to the internet. Option A is wrong because the user is an IAM user, not root. Option C is wrong because the event is logged, which is good. Option D is wrong because the API is AuthorizeSecurityGroupIngress, not Revoke.

Answer

The user is revoking a security group rule.

Answer

The event is not being logged by CloudTrail.

Answer

The user is using the AWS root account.

Question 12

A security team wants to detect and alert on potential security threats such as compromised instances or malicious activity within their AWS environment. Which TWO AWS services should be used together to provide comprehensive threat detection?

Accepted Answer

AWS Security Hub. Amazon GuardDuty provides intelligent threat detection, and AWS Security Hub aggregates findings from multiple services including GuardDuty. Option A and Option C are correct. Option B is wrong because CloudTrail is for logging, not threat detection. Option D is wrong because Inspector is for vulnerability assessments. Option E is wrong because Config is for configuration compliance.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS Config

Question 13

A company uses Amazon Route 53 for DNS and wants to log all DNS queries made from its VPC. The logs must be stored in Amazon S3 for compliance purposes. Which solution meets these requirements?

Accepted Answer

Enable Route 53 Resolver query logging and publish to an S3 bucket.. Option B is correct because Route 53 Resolver query logs can log DNS queries made by resources within a VPC and can be exported to S3. Option A is wrong because VPC Flow Logs capture IP traffic, not DNS queries. Option C is wrong because CloudWatch Logs can capture logs but not directly from Route 53 Resolver without additional configuration. Option D is wrong because AWS CloudTrail does not log DNS query content.

Answer

Install a CloudWatch Logs agent on each EC2 instance and configure it to send DNS logs to CloudWatch Logs.

Answer

Enable AWS CloudTrail for DNS API calls and deliver to an S3 bucket.

Answer

Enable VPC Flow Logs and publish to an S3 bucket.

Question 14

A security team wants to centrally collect and analyze VPC Flow Logs from multiple AWS accounts for security monitoring. Which solution is MOST scalable and cost-effective?

Accepted Answer

Use AWS Organizations to centralize logging by delivering VPC Flow Logs to a centralized S3 bucket and query with Amazon Athena.. Option D is correct because using AWS Organizations with a centralized S3 bucket and Amazon Athena allows scalable querying of VPC Flow Logs across accounts without additional data transfer costs. Option A is wrong because sending logs to a centralized CloudWatch Logs account from multiple accounts requires cross-account subscriptions and incurs data transfer costs. Option B is wrong because Kinesis Data Firehose with Lambda adds complexity and cost. Option C is wrong because using an EC2 instance for log analysis is not scalable or cost-effective.

Answer

Aggregate logs in an EC2 instance running an ELK stack.

Answer

Use Amazon Kinesis Data Firehose to stream logs to an S3 bucket and process with AWS Lambda.

Answer

Configure VPC Flow Logs to send to a centralized CloudWatch Logs account using cross-account subscriptions.

Question 15

A security engineer configured the S3 bucket policy shown above for CloudTrail log delivery, but CloudTrail is not delivering logs. What is the MOST likely reason?

Accepted Answer

The policy does not include s3:GetBucketAcl permission.. Option C is correct because the bucket policy must also grant the s3:GetBucketAcl action for CloudTrail to verify the bucket ACL. Option A is wrong because encryption is not required. Option B is wrong because the region is not specified in the policy. Option D is wrong because the resource ARN is correct for CloudTrail logs.

Answer

The bucket is in the wrong region.

Answer

The resource ARN is incorrect.

Answer

The bucket does not have default encryption enabled.